dotnet security: Get an unauthenticated windowsIdentity? -- dotnet security

You're in the

dotnet security

group:

Get an unauthenticated windowsIdentity?

Re: Get an unauthenticated windowsIdentity?

Dominick Baier [DevelopMentor]
7/18/2005 8:45:49 AM

dotnet security: Hello ep,

give

WindowsIdentity.GetAnonymous() a try

HTH

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

[quoted text, click to view]

Get an unauthenticated windowsIdentity?

ep
7/18/2005 10:26:58 AM

I have a case where I need to get a WindowsIdentity for an account that has
not been authenticated. Is this possible?

It looks like the only way to do it so far has been to get a token from
LogonUser first, but I want to get the identity without logging on.

Re: Get an unauthenticated windowsIdentity?

Joe Kaplan (MVP - ADSI)
7/18/2005 10:44:15 AM

If you have 2003 servers and a 2003 native mode AD domain, you can use
protocol transition/Kerberos S4U. This is very easy to take advantage in
..NET. Just use the constructor on WindowsIdentity that takes the user's UPN
as the only argument. It works great.

Note that to get a token you can impersonate, you need to be running with
Act as part of the operating system privilege, but if you just want to check
group membership and such, it is great for that.

Joe K.

[quoted text, click to view]

Re: Get an unauthenticated windowsIdentity?

Dominick Baier [DevelopMentor]
7/18/2005 2:15:14 PM

Hello Dominick Baier [DevelopMentor],

ah ok - so maybe i misunderstood you -

yes - the only way of getting a token without knowledge of the password is
to use Protocol Transition - which will limit you to native w2k3 domains.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

[quoted text, click to view]

Re: Get an unauthenticated windowsIdentity?

ep
7/18/2005 4:54:38 PM

well, needs to be win2k/xp pro/win2k3.

GetAnonymous() doesn't work because I need the identity for a particular
account.

"Dominick Baier [DevelopMentor]" <dbaier@pleasepleasenospamdevelop.com>
[quoted text, click to view]

Re: Get an unauthenticated windowsIdentity?

Joe Kaplan (MVP - ADSI)
7/18/2005 8:00:06 PM

This is essentially impossible as far as I know unless you write your own
SSPI logon provider or something which is a significantly challenging
undertaking. I'm not positive though. It might be a good question for
ms.public.platformsdk.security.

Joe K.

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the dotnet security group.

home · blog · groups

Questions? Comments? Contact the dn